Event Horizon

Platform: HackTheBox | Category: Forensics | Difficulty: Easy | Author: D3v0o0Nu11 | Date: 2026-02-10

Description

Our CEO's computer was compromised in a phishing attack. The attackers took care to clear the PowerShell logs, so we don't know what they executed. Can you help us?

Solution Approach

Core idea: Identify the weakness from source review or fingerprinting first. Iterate with incremental payloads instead of guessing.

Steps

1. First, unzip the .zip file given.

2. Got 2 directories.

3. Looks like there's nothing in Traceformat directory.

4. Hence, all of these 324 files are inside the Logs directory.

5. When i checked all the file types. It's MS Windows Vista Event Log.

6. Based on the description, the attackers clear the PowerShell logs. Let's filter the file listing.

7. Since it's windows event log, so we shall open it in windows.

8. Let's check this file first:

9. Try this one:

10. Now this one:

11. At eventID 4100 we got a warning.

12. Looks like there's a htb flag prefix encoded in base64.

13. Try to decode that.

14. Got the flag!

Flag

REDACTED

Lessons Learned

1. Identify the weakness from source review or fingerprinting first.
2. Iterate with incremental payloads instead of guessing.
3. Reuse the same pattern in future engagements.